elharo opened a new issue, #150: URL: https://github.com/apache/maven-jarsigner-plugin/issues/150
**Affected version:** HEAD **Files:** - `src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:540` - `src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:313` Both `processArchive()` and `createRequest()` call `decrypt(null)` when `storepass` or `keypass` are not configured: ```java // AbstractJarsignerMojo.java:540 request.setStorepass(decrypt(storepass)); // JarsignerSignMojo.java:313 request.setKeypass(decrypt(keypass)); ``` The `decrypt()` method passes this null to `securityDispatcher.decrypt(null)`. While the default `SecDispatcher` implementation may handle null gracefully, this is an unnecessary call that depends on implementation-specific behavior. The fix should skip the `decrypt()` call if the password is null. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
